feat: 员工端密码登录完整支持

1. createEmployee 创建员工时自动设置默认密码（手机号后6位）
2. 管理员重置密码接口 POST /employees/:id/reset-password
   （重置为手机号后6位）
3. 员工自己修改密码接口 POST /portal/change-password
   （需验证旧密码，新密码至少6位）
4. 花名册详情添加"重置密码"按钮，显示默认密码提示
5. 员工端导航栏添加"修改密码"入口，弹窗修改密码

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

backend/src/routes/employee.routes.ts

@@ -1,4 +1,5 @@
 import { Router } from 'express'
+import bcrypt from 'bcryptjs'
 import { authMiddleware, AuthRequest } from '../middleware/auth'
 import { auditLog } from '../middleware/auditLog'
 import { createEvidence } from '../services/evidence.service'
@@ -195,6 +196,30 @@ router.delete('/:id', authMiddleware, async (req: AuthRequest, res, next) => {
   }
 })
 
+/**
+ * 管理员重置员工密码（重置为手机号后6位）
+ * POST /employees/:id/reset-password
+ */
+router.post('/:id/reset-password', authMiddleware, async (req: AuthRequest, res, next) => {
+  try {
+    const employee = await prisma.employee.findFirst({
+      where: { id: req.params.id, orgId: req.user!.orgId },
+      select: { id: true, phone: true, name: true },
+    })
+    if (!employee) {
+      return res.status(404).json({ success: false, error: { code: 'NOT_FOUND', message: '员工不存在' } })
+    }
+    // 重置为手机号后6位，无手机号则用 123456
+    const defaultPassword = employee.phone ? employee.phone.slice(-6) : '123456'
+    const passwordHash = await bcrypt.hash(defaultPassword, 10)
+    await prisma.employee.update({ where: { id: employee.id }, data: { passwordHash } })
+    await auditLog(req, 'RESET_PASSWORD', 'EMPLOYEE', employee.id, { employeeName: employee.name })
+    res.json({ success: true, data: { message: `密码已重置为手机号后6位：${defaultPassword}` } })
+  } catch (err) {
+    next(err)
+  }
+})
+
 // 批量续签合规预检
 router.post('/contracts/preview-renew', authMiddleware, async (req: AuthRequest, res, next) => {
   try {